System and method for controlling redundant communication links in networked safety systems

FIELD OF THE INVENTION

[0001] This invention relates in general to networked safety systems, and more particularly to a system, apparatus, and method for monitoring and controlling selection of redundant LAN communication links in response to total or limited failures of the active communication links in a networked safety system.

BACKGROUND OF THE INVENTION

[0002] Safety systems are used in a many different environments ranging from personal safety systems to wide-reaching, networked safety systems. Small scale safety systems include, for example, home security systems, smoke detectors, and the like. On a larger scale, buildings and campuses generally include safety and possibly security systems. For example, fire and smoke systems, access systems, security systems, etc. are all within the purview of building safety systems. Due to the size of buildings relative to single-family dwellings and the generally higher number of people that may be within the building at a given time, additional safety requirements are usually necessary. These additional safety requirements are driven by the desire to provide a safe and functional environment, and may also be driven by various safety regulations. Agencies such as the National Fire Protection Association (NFPA), Occupational Safety & Health Administration, etc. set forth requirements for certain safety systems, particularly fire safety systems. In addition to these regulatory requirements, certification of various aspects of a system may be obtained from other organizations, such as the Underwriters Laboratories Inc. (UL).

[0003] Specific components or devices used in fire safety systems may be individually UL-approved. For example, smoke detectors, heat sensors, alarm pull stations and other devices that form part of the collective fire alarm system may require UL approval. Vendors of such individual components may obtain the requisite UL approval. However, a system developer may be subject to system-level safety requirements, such as the interface between such components, control of the components, component redundancies, communication link redundancies, etc. In these cases, the system developer often seeks UL approval at the system level.

[0004] Today's networking technologies provide the system developer with great flexibility in monitoring and controlling fire systems. For example, monitoring and/or control of discrete detectors or groups of detectors may be accomplished at a central location, or such functions may be distributed over multiple locations. Monitoring and control may be performed through direct communication links, through Local Area Networks (LANs), and/or remotely. To facilitate aggregate monitoring and control of the various detectors and components used in the fire system, these detectors and components may be networked with a central processing system(s). In some cases, direct communication links may be sufficient, such as where a small number of detectors are utilized, and a central processing system can directly monitor and control such devices. At the other end of the spectrum, fire systems can be monitored and controlled via Wide Area Networks (WANs) or Global Area Networks (GANs) such as the Internet, where one or more central processing systems monitor and control devices at remote locations. A common implementation is a fire system located within a building or campus, where LANs are used to facilitate communication between the processing systems and the sensors, detectors, etc. System-level safety requirements may dictate the manner in which such systems operate via the LAN or other network. One such system-level requirement involves the integrity of communication links within the network environment of a fire safety system.

[0005] In the context of LANs, for example, various communication protocols and physical media may be used. For example, LANs may be established using different types of physical links, such as twisted-pair wires, coaxial cable, etc. Different communication protocols may be used to communicate over the physical links. As a particular example, one commonly implemented LAN implementation employs Ethernet technology. Ethernet technology and its analogous Institute of Electrical and Electronics Engineers, Inc. (IEEE) 802.3 standards are well known local area networking technologies. As previously indicated, system-level safety requirements may govern the manner in which LAN connections, such as Ethernet connections, are to be implemented in order to comply with safety regulations. For example, a requirement exists in some fire system applications that redundant communication paths be provided to monitor the integrity of the communication links associated with the LAN connection. One example of such a requirement is UL standard 864, which is a standard for control units for fire-protective signaling systems. This standard is based upon NFPA 72, the National Fire Alarm Code. This code explicitly describes the current requirements for redundant communication paths used in safety systems. Presently, there is no system that complies with this code for fire safety systems using redundant Ethernet (or analogous) LAN connections.

[0006] Accordingly, there is a need for a manner of providing reliable, redundant network communication links in safety systems such as fire safety systems. The present invention fulfills these and other needs, and offers other advantages over the prior art.

SUMMARY OF THE INVENTION

[0007] To overcome limitations in the prior art described above, and to overcome other limitations that will become apparent upon reading and understanding the present specification, the present invention discloses a system, apparatus and method for maintaining communication integrity in a safety system.

[0008] In accordance with one embodiment of the invention, a method is provided for maintaining communications on a safety system network connection. The method includes communicating a link integrity signal indicative of a communication state on a first network communication link. A control signal is generated that has characteristics corresponding to the communication state of the first network communication link. A communication link switch is coupled to the first network communication link and one or more second or “backup” network communication links, and this link switch is controlled in response to the control signal characteristics. Via the communication link switch, switching from the first network communication link to one of the second network communication links at the communication link switch is effected when the control signal characteristics indicate a failure affecting any one or more signals associated with the first network communication link. For example, if any two or more signals of the network communication link are shorted together, or any of the signals are open-circuited, the link integrity signal will be disrupted, and the control signal will be generated such that this condition may be used to ultimately control the communication link switch.

[0009] In accordance with another embodiment of the invention, a network interface for maintaining communication integrity with at least one central processor in a safety system is provided. The network interface includes a communication link redundancy module, which includes a controllable link switch for activating one of a plurality of selectable communication links between the communication link redundancy module and the central processor. A terminal server is coupled to the link switch to communicate with the central processor via the currently-activated communication link. The terminal server includes a link signal detector to monitor a link signal indicative of a communication state of the activated communication link and to generate a control signal in response to the link signal. An interface circuit is coupled to the terminal server to receive the control signal, and to generate a command to the controllable link switch to select a different one of the plurality of selectable communication links when the control signal indicates a failure of any one or more signals associated with the currently-activated communication link.

[0010] In accordance with another embodiment of the invention, a safety system is provided. The safety system may include, for example, fire/smoke safety systems, security systems, access systems, and the like. The safety system includes one or more control panels, each control panel being coupled to any number of safety devices to control and/or monitor the safety devices. At least one central processing system is provided to, among other things, collect data from the one or more control panels. A network interface module is coupled to the control panels and the central processing system to facilitate communication between the control panels and the central processing system. The network interface module includes a communication link redundancy module which includes a controllable link switch for activating one of a plurality of selectable communication links between the communication link redundancy module and the central processor. A terminal server is provided with the network interface module, and is coupled to the link switch to communicate with the central processor via the currently-activated communication link. The terminal server includes a link signal detector to monitor a link signal indicative of a communication state of the activated communication link, and to generate a control signal in response. The network interface module further includes an interface circuit coupled to the terminal server to receive the control signal, and to generate a command to the controllable link switch to select a different one of the plurality of selectable communication links when the control signal indicates a failure of any one or more signals associated with the currently-activated communication link.

[0011] These and various other advantages and features of novelty which characterize the invention are pointed out with particularity in the claims annexed hereto and form a part hereof. However, for a better understanding of the invention, its advantages, and the objects obtained by its use, reference should be made to the drawings which form a further part hereof, and to accompanying descriptive matter, in which there are illustrated and described specific examples of a system, apparatus, and method in accordance with the invention.

BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The invention is described in connection with the embodiments illustrated in the following diagrams.

[0013]FIG. 1 is a block diagram illustrating a representative networked safety system in which the present invention may be employed;

[0014]FIG. 2 is a block diagram illustrating one embodiment of a LAN interface in accordance with the present invention;

[0015]FIG. 3 is a block diagram illustrating a portion of a LAN interface in accordance with a more particular embodiment of the invention;

[0016]FIGS. 4 and 5 are flow diagrams of various embodiments of methods for controlling a plurality of redundant communication links in a networked safety system;

[0017]FIG. 6 is a flow diagram illustrating one embodiment of a method for attempting to re-establish communication on a previously failed communication link; and

[0018]FIG. 7 is a flow diagram of a representative initialization process to initially establish an active communication link.

DETAILED DESCRIPTION OF THE INVENTION

[0019] In the following description, reference is made to the accompanying drawings which form a part hereof, and in which is shown by way of illustration particular embodiments in which the invention may be practiced. It is to be understood that other embodiments may be utilized, as structural and operational changes may be made without departing from the scope of the present invention.

[0020] Generally, the present invention provides a manner of controlling communication on a plurality of network communication links in a networked system, such as fire safety systems, access control systems, security systems, and other networked systems. One such networked safety system is the Honeywell LifeSafety Manager™, which provides monitoring and control of a building's (or group of buildings') life safety functions, such as smoke and fire detection, sprinkler supervision, emergency communications, etc. While functions associated with such a system can be performed via one or more control panels coupled to respective sensors and control circuits, operators can also monitor and control a portion or all of the system by way of one or more central processing systems that communicate with the various control panels, detectors, and other circuits by way of a network. Due to safety regulations as well as the overriding desire to maximize safety, redundancies and other fail-safe design considerations are often implemented to minimize the impact of failures in such a system, including redundancies in the network connections to these central processing systems. The present invention provides a manner of monitoring the integrity of communication links in such network connections, and in response, selecting an operable communication link among a plurality of available communication links.

[0021]FIG. 1 is a block diagram illustrating a representative networked safety system <b>100</b> in which the present invention may be employed. A number of devices <b>102</b> may be coupled to a control panel <b>104</b>A. The control panel <b>104</b>A and devices <b>102</b> may represent, for example, a life safety system panel, such as the XLS1000 system commercially provided by Honeywell Inc., Golden Valley, Minn., U.S.A. The devices <b>102</b> may include any number of detectors, sensors, controllers, etc., to detect and control safety-related conditions. For example, the devices <b>102</b> may include photoelectric, ionization, and thermal sensors to detect conditions such as smoke, heat, or other conditions relating to the possible presence of a fire. The devices <b>102</b> may also provide control circuits for controlling a facilities' Heating, Ventilation and Air Conditioning (HVAC) equipment such as fans and dampers, to contain smoke and create safe havens. Control functions may also perform tasks such as releasing fire doors to permit safe exit, monitoring fire “pull stations,” and monitoring/controlling on-site sprinkler systems and fire pumps. A number of similar control systems <b>104</b>B, <b>104</b>C, etc. may be provided to extend the networked safety system <b>100</b> by way of, for example, a peer network.

[0022] These devices <b>102</b> may be coupled to the control panel <b>104</b>A, from which monitoring and/or control of the devices may be performed. However, as previously indicated, it may be desirable to monitor/control such devices via one or more central processing systems <b>106</b> that communicate with the various control panels, detectors, and other circuits by way of a network. To communicate with the central processing system <b>106</b> via a network, a network interface <b>108</b> is provided in accordance with the present invention. In the illustrated example, the network is a local area network (LAN), and the network interface <b>108</b> thus represents a LAN interface. In this manner, the control panel <b>104</b>A (and other control panels <b>104</b>B, <b>104</b>C) can communicate with the central processing system(s) <b>106</b> via the LAN interface <b>108</b>.

[0023] In one embodiment of the invention, the control panel <b>104</b>A communicates with the LAN interface <b>108</b> via a serial communication interface, although other communication interfaces such as a parallel interface may also be implemented. In a more particular embodiment, the control panel <b>104</b>A and LAN interface <b>108</b> communicate via the well-known RS-232. RS-232 is a single-ended data transmission technology that utilizes independent channels for full-duplex communication. Alternatively, other single-ended data transmission specifications may be used, such as RS423, etc. Furthermore, differential data transmission technologies may alternatively be employed, such as RS422 or RS485, which may be beneficial for longer or inherently “noisy” connections. Any appropriate data transmission technology may be used to communicate between the control panel(s) <b>104</b>A, <b>104</b>B, <b>104</b>C and the LAN interface <b>108</b>.

[0024] In one embodiment, the RS-232 interface is established between the control panel <b>104</b>A and an interface circuit <b>110</b> of the LAN interface <b>108</b>. The interface circuit <b>110</b> communicates with a device or terminal server <b>112</b> that facilitates the interface to the LAN. The device/terminal server <b>112</b> may represent, for example, a LANTRONIX UDS-10 device/terminal server, COBOX-E2 device/terminal server, COBOX-FL device/terminal server, or other analogous device server device.

[0025] The LAN interface <b>108</b> communicates over a network, such as a standard Ethernet network, to the central processing system <b>106</b>. The central processing system <b>106</b> represents, for example, a computer or other computing system capable of collecting data from the LAN interface and optionally from other types of building control systems. Via this computing system <b>106</b>, the information, alarms, etc. can be displayed and/or controlled. As is described in greater detail below, the interface circuit <b>110</b>, terminal server <b>112</b>, and communication link backup module <b>114</b> of the LAN interface <b>108</b> provide the ability to select between a plurality of communication links to the network, on which the central processing system <b>106</b> may be connected. For example, a primary communication link <b>116</b> may be provided, along with one or more redundant communication links <b>118</b>A, <b>118</b>B, etc. In one embodiment of the invention, two redundant communication links are provided, including the primary link <b>116</b> and a redundant link <b>118</b>A. This connection may be made directly from the LAN interface <b>108</b> to the central processing system <b>106</b>, or alternatively an intermediary hub <b>120</b> or other switch may be used to access a central processing system <b>106</b> on the LAN backbone <b>122</b>. The redundant communication links used in accordance with the present invention greatly enhances communication integrity between the control panel <b>104</b>A, <b>104</b>B, etc. (and/or devices <b>102</b>) and the central processing system <b>106</b> through monitoring, control, and selection of the appropriate communication links <b>116</b>, <b>118</b>A between the LAN interface <b>108</b> and the central processing system <b>106</b>. As will be described in greater detail below, the interface circuit <b>110</b>, terminal server <b>112</b>, and master communication link redundancy module <b>114</b> in one embodiment of the invention provide this monitoring, control, and selection of the appropriate communication link to a slave communication link redundancy module <b>124</b> and ultimately to the central processing system <b>106</b>.

[0026] The present invention addresses communication redundancy issues between the LAN interface <b>108</b> and the central processing system <b>106</b> (or hub <b>120</b>) as part of the standard network. For purposes of illustration and not of limitation, the network and LAN connection are described herein in terms of an Ethernet network or analogous network such as the IEEE 802.3 standard (hereinafter collectively referred to as Ethernet). It should be recognized, however, that the principles described herein may be applied to other networking technologies, and the invention is clearly not limited to the representative Ethernet embodiments described herein.

[0027] Generally, Ethernet refers to a local area network (LAN) technology used for connecting computing equipment within a particular area. Ethernet operates over coaxial cable, twisted pair, various multi-conductor cables. For LAN interconnection, Ethernet is a physical link and data link protocol reflecting the two lowest layers of the OSI model. Ethernet specifies a CSMA/CD (Carrier Sense Multiple Access with Collision Detection), which is a technique of sharing a common medium among several devices. If a node on the network detects a collision, it alerts the other nodes by jamming the network. Then, after a random delay, the sending nodes try again.

[0028] Devices that connect directly to a LAN often do so through a network interface card (NIC) or circuitry providing analogous functionality. A NIC and associated transceiver may provide functions including, for example, providing a physical interface to the transmission medium, monitoring busy/idle status of the network, buffering the speeds and converting protocols between devices and the network, assembling the transmitted data stream into packets and restoring the data stream at the receiving end, recovering from collisions, etc. In one embodiment of the invention, the central processing system(s) <b>106</b> includes at least one NIC to provide the physical interface to the LAN.

[0029] In accordance with the present invention, the redundant connections (e.g., including the primary <b>116</b> communication link and one or more redundant <b>118</b>A, <b>118</b>B communication links) enable continued communications in the event of a failure of any one of the communication links. In one embodiment, the interface circuit <b>110</b> monitors the condition of the LAN via a control signal(s) from the terminal server <b>112</b>. If a short circuit between any one or more signal paths of the communication link occurs on the currently-active Ethernet communication link, or an open circuit of any of the signal paths occurs on the currently-active Ethernet communication link, the control signal from the terminal server <b>112</b> will indicate such a short or open circuit condition. This signal from the terminal server <b>112</b> is recognized by the interface circuit <b>110</b>, which in turn controls the communication link backup module <b>114</b> to switch the connection to another communication link, thereby maintaining the LAN connection. The ability to recognize any short or open circuit condition of any of the signal paths associated with the LAN connection, and to appropriately select a redundant communication link in response thereto, provides reliability for the LAN connection as a whole. Embodiments of the invention that provide such redundant communication links for any such short and open signal path condition advantageously complies with respective requirements of the UL standard 864.

[0030]FIG. 2 is a block diagram illustrating one embodiment of a LAN interface <b>200</b> in accordance with the present invention. Similarly to that described in FIG. 1, the illustrated embodiment of FIG. 2 provides the LAN interface between the control panel <b>202</b> and the central processing system <b>204</b>. The illustrated control panel <b>202</b> includes an RS-232 port <b>206</b> which communicates serially with the interface assembly <b>208</b> via RS-232 port <b>210</b>, although any desired data communication interface may be implemented. The interface assembly <b>208</b> includes another data communication port, an RS-232 port <b>212</b> in the illustrated example, for communicating with the terminal server <b>214</b> via its RS-232 port <b>216</b>. The terminal server <b>214</b> ultimately communicates with the central processing system across the network (e.g., LAN) via the network/LAN interface <b>218</b> at the terminal server <b>214</b> and the network interface card (NIC) <b>220</b> at the central processing system <b>204</b>. In this manner, information can be communicated between the control panel(s) <b>202</b> and the central processing system(s) <b>204</b>.

[0031] In accordance with the present invention, the connection between the terminal server <b>214</b> (or other analogous device server providing the network interface) and the central processing system <b>204</b> is configured to include redundant communication links. In accordance with one embodiment of the invention, a communication link redundancy module <b>222</b> is provided, which facilitates selection of one of a plurality of available communication links in which to communicate across the network. In the illustrated embodiment, the network connection is a LAN connection employing Ethernet/IEEE 802.3 technology; i.e., 10Base-T technology. However, other similar technologies such as 100Base-T, Gigabit Ethernet, etc. may also be utilized in connection with the present invention.

[0032] The communication link redundancy module (CLRM) <b>222</b> provides a plurality of LAN ports each associated with a respective redundant LAN communication link. In the illustrated embodiment of FIG. 2, two LAN ports are provided including the primary port <b>224</b> and the backup port <b>226</b>, which facilitate communication across redundant LAN communication links <b>228</b>, <b>230</b> respectively. More particularly, information transmitted from the control panel <b>202</b> is passed from the interface assembly <b>208</b> to the terminal server <b>214</b>, which in turn performs the appropriate protocol conversion to pass the information via the network interface <b>218</b>. The information is provided to a link switch module <b>232</b> of the master CLRM <b>222</b>. In response to commands generated at the interface assembly <b>208</b> (described in greater detail below), the link switch module <b>232</b> switches the information to one of the redundant LAN ports <b>224</b>, <b>226</b>. The information is transmitted across the respective communication link <b>228</b>, <b>230</b>. In one embodiment of the invention, a slave CLRM <b>234</b> receives the information and provides it to the NIC <b>220</b> of the central processing system <b>204</b>. In one embodiment, the central processing system may be coupled to the LAN backbone <b>236</b> via a hub <b>238</b> or other switching/routing device. Information may be transmitted from the central processing system <b>204</b> to the control panel <b>202</b> in an analogous fashion.

[0033] In accordance with the present invention, the appropriate communication link <b>228</b>, <b>230</b> is selected based on the communication state of the communication links, or at least on the communication state of the currently-active communication link. In one embodiment, the integrity of the currently-active communication link is monitored by sending signals or messages between the central processing system <b>204</b> and the LAN interface <b>200</b>, even during idle periods. If the signals/messages cease or are otherwise disrupted, it can be detected as a communication link fault, prompting switching to a redundant communication link. In accordance with the present invention, any disturbance of signals transmitted across the network disrupts the signal/message so that individual or collective short or open circuit conditions on the LAN communication link are detected.

[0034] In one embodiment of the invention, the signal used to monitor the integrity of the active communication link is a link pulse provided by Ethernet/IEEE 802.3 network interfaces. In general, the Ethernet physical layer for each transmission rate is typically divided into sublayers that are independent of the particular media type, and sublayers that are specific to the media type or signal encoding. The physical medium attachment (PMA) sublayer generally contains the signal transmitters and receivers (transceivers). A representative Ethernet version (e.g., 10Base-T) includes a link integrity test to determine the health of the communication link. A normal link pulse (NLP), an out-of-band communications mechanism, is used to indicate link status. After power on, the PMA typically transmits a link pulse (NLP) to tell the NIC or other network interface at the other end of the link that this NIC wants to establish an active link connection. If the network interface at the other end of the communication link is also powered on, it will respond with its own link pulse. Alternatively, if the network interface at the other end of the link is not powered up, this NIC continues to send a link pulse periodically until it receives a response. The link is activated after both network interfaces are capable of exchanging valid link pulses. The network interfaces then continually monitor the receive data path for activity as a means of checking that the communication link is working properly, and when the network is idle, the network interfaces send the NLP to one another to verify link integrity. Alternatively, autonegotiation functions in other network interfaces may use a modified 10Base-T link integrity pulse sequence where the normal link pulses (NLPs) are replaced by bursts of fast link pulses (FLPs). For example, an FLP may include a number of clocking pulses interspersed with a number of signal pulses to form an x-bit bit code word. If a signal pulse occurs between two clocking pulses, that bit is a binary “1,” where absence of such a signal pulse is a “0.”

[0035] Other analogous communication link integrity signals may also be used in connection with the present invention, including the exchange of messages over the LAN connection itself, or other inter-device signaling technologies. For example, in one embodiment of the invention, the central processing system <b>204</b> periodically (e.g., every 5 seconds) transmits a message indicating that it is operable. The LAN interface in such an embodiment is assigned a unique Internet Protocol (IP) address on the LAN, and can be designated as the targeted recipient of this message. When the terminal server <b>214</b> or other designated circuitry within the LAN interface recognizes this message, it responds with its own operability message using the IP address of the central processing system <b>204</b> (or hub <b>238</b>, as the case may be). These messages are sent back and forth and any desired rate, thereby allowing additional control as to the length of time in which a communication link problem has occurred. When either the LAN interface <b>200</b> and/or the central processing system <b>204</b> recognizes that a message was not returned within a particular time, a message retry operation may optionally be performed, and the problem is then recognized if communication was unsuccessful. As in the case where an NLP is monitored, any short circuit and/or open circuit condition on the LAN connection will disrupt the message. Either the disrupted message, and/or the loss of further messages due to discontinuing sending messages when a disrupted message is recognized, will be detected at the link signal detector <b>240</b>.

[0036] By using any such link signal or message (hereinafter referred to as “link signal”), the LAN interface <b>200</b> can detect a problem on a currently-active communication link <b>228</b>, <b>230</b>, and can initiate a change to a redundant communication link in response thereto. The terminal server <b>214</b> may first detect the disruption to the link signal via the link signal detector <b>240</b>. Alternatively, the central processing system <b>204</b> may detect the disruption to the link signal, and in response can suspect further transmission of its link signal. Suspension of the link signal then allows the terminal server <b>214</b> to detect the loss of the link signal via the link signal detector <b>240</b>. In either case, the terminal server <b>214</b> monitors for the link signal to confirm that the present communication link is functioning properly. When the link signal detector <b>240</b> determines that the link signal has not occurred in a particular time duration, the link signal detector <b>240</b> provides an indication of this condition by way of a control signal to the interface assembly <b>208</b>, as illustrated by signal path <b>242</b> to the connection state monitor circuit <b>244</b>.

[0037] It is noted that the link signal is disrupted in response to any short circuit or open circuit condition of the LAN communication link. For example, one representative LAN connection includes four conductors including two transmit conductors (e.g., Tx−, Tx+) and two receive conductors (e.g., Rx−, Rx+). Any short circuit between any two or more of these conductors causes the link signal to be disrupted from its normal condition and/or causes the link signal to cease completely. Further, an open circuit condition of any one or more of the transmit/receive conductors will also cause the link signal to be disrupted and/or suspended. Any combination of such short circuit and open circuit conditions also disrupts the link signal. Therefore, in accordance with the present invention, any one or more short circuit and/or open circuit conditions will cause the link signal to be suspended, which is detected by the link signal detector <b>240</b> at the terminal server <b>214</b>.

[0038] As previously described, when a disruption/suspension of the link signal has been detected, the link signal detector <b>214</b> provides a control signal of this condition to the interface assembly. In one embodiment of the invention, this control signal is sent to the interface assembly via the RS-232 ports <b>216</b>, <b>212</b>. The connection state monitor circuit <b>244</b> monitors for this control signal. In one embodiment, the control signal is represented by a change of logic state of the monitored signal on signal path <b>242</b>. When the connection state monitor circuit <b>244</b> recognizes a change of state of the control signal, thereby indicating disruption/loss of the link signal, it provides a command(s) to the CLRM <b>222</b> as shown on signal path <b>246</b>. This command is ultimately used to control switching of the active communication link to a redundant communication link, as described more fully below. The connection state monitor circuit <b>244</b> may be implemented using discrete hardware components, processor/software, or a combination thereof. For example, in one embodiment of the invention, the connection state monitor circuit <b>244</b> includes a processor <b>248</b> and associated software/firmware <b>250</b>. Using polling, interrupts, or other monitoring techniques, a processor-based monitor circuit <b>244</b> recognizes the change of state of the control signal provided by the terminal server <b>214</b> when the link pulse is disrupted/suspended. Such a processor-based monitor circuit <b>244</b> can also create and initiate transmission of the appropriate command to control the functions at the CLRM <b>222</b>. In one embodiment of the invention, commands provided on signal path <b>246</b> includes a series of pulses, and a particular command is used to cause the CLRM <b>222</b> to switch from the current communication link to another communication link.

[0039] In one particular embodiment, the control signal from the terminal server <b>214</b> is monitored by a processor-software-based connection state monitor circuit <b>244</b>. When the control signal changes state indicating a disruption/loss of the link signal, one or more commands are sent from the connection state monitor circuit <b>244</b> to the master CLRM <b>222</b> as shown on signal path <b>246</b>. The master CLRM <b>222</b> includes demodulator/control logic <b>250</b> to demodulate the commands if necessary. The commands direct the control logic <b>250</b> to perform particular functions. In one embodiment of the invention, one command directs the control logic <b>250</b> to switch the connection to another communication link, based on the connection state monitor circuit's <b>244</b> recognition of the control signal indicating a disruption/loss of the pulse signal. In response, the control logic <b>250</b> provides a switch control signal to an associated link switch <b>232</b>, which in turn establishes the LAN connection using one of the plurality of available LAN ports. In the illustrated example, two LAN ports <b>224</b>, <b>226</b> are provided, and the link switch <b>232</b> will establish the LAN connection using the LAN port that is not associated with a faulty communication link.

[0040] For example, assume that the active communication link is communication link <b>228</b> associated with the primary port <b>224</b>. The disruption/loss of the pulse signal detected by the link signal detector <b>240</b> indicates that any one or more signals on the communication link <b>228</b> have short circuited and/or open circuited. The terminal server <b>214</b>, by way of the link signal detector or associated circuitry, provides the control signal to the connection state monitor circuit <b>244</b> via signal path <b>242</b>. The connection state monitor circuit <b>244</b> recognizes the disruption/loss of the pulse signal based on the state of the control signal, and in response sends a command via signal path <b>246</b> to the control logic <b>250</b> of the master CLRM <b>222</b>. The control logic sends the appropriate switch control signal to the link switch <b>232</b> to switch from the primary port <b>224</b> to the backup port <b>226</b>, thereby re-establishing the LAN connection to the central processing system <b>204</b> (or hub <b>238</b>) via communication link <b>230</b>.

[0041] In one embodiment of the invention, a command is periodically sent from the connection state monitor circuit <b>244</b> to the control logic <b>250</b>, even if it is a repeat of the last command sent. For example, the command may be sent every fifteen seconds, regardless of whether the signal embodied by the command has changed. If the CLRM <b>222</b> does not receive the signal within a predetermined time (e.g., thirty seconds), it will initiate the switch control signal to notify the link switch <b>232</b> to switch to the primary port and activate the alarm signal. One or more timers <b>252</b> may be used to determine whether the signal has been received within the requisite time. In this manner, an alarm signal can be activated even if a problem occurs in sending the command from the interface assembly <b>208</b> to the CLRM <b>222</b>.

[0042] Another command that may be sent from the interface assembly <b>208</b> to the master CLRM <b>222</b> in response to a faulty communication link is a command to close/open a relay contact. More particularly, a command may be sent by the connection state monitor circuit <b>244</b> to the control logic <b>250</b> via signal path <b>246</b> to direct the control logic <b>250</b> to cause the alarm relay <b>254</b> to activate the alarm <b>256</b>. This may be effected by way of the command from the interface assembly <b>208</b>, or alternatively may be effected internally at the CLRM <b>222</b>. For example, in the scenario described above where a problem occurs in sending the command from the interface assembly <b>208</b> to the CLRM <b>222</b>, the CLRM <b>222</b> can cause a redundant port/link to be selected after expiration of the time delay, and may also cause the alarm relay <b>254</b> to activate the alarm <b>256</b>. It should be noted that while the alarm relay <b>254</b> and alarm <b>256</b> are illustrated as being part of the CLRM <b>222</b>, this need not be the case. In one embodiment, the alarm relay <b>254</b> is housed on a circuit board associated with the LAN interface <b>200</b>, and the alarm(s) may be positioned on the various control panels <b>202</b> and/or the central processing system(s) <b>204</b> in the system.

[0043] The commands send from the interface assembly <b>208</b> to the master CLRM <b>222</b> may also include signals to open or close the LAN connection. For example, the transmit and receive conductors can be short-circuited to close the LAN connection, and the transmit and receive conductors can be open-circuited to open the LAN connection. This may be used, for example, during initialization of the system to initially determine an appropriate communication link in which to establish communication. In such a case, the control logic <b>250</b> sends an open/close (O/C) signal to the appropriate ports <b>224</b>, <b>226</b> in response to the command sent by the interface assembly <b>208</b>.

[0044] Further functionality may be employed to further confirm operation of the redundant communication links. For example, the interface assembly <b>208</b> may direct the master CLRM <b>222</b> to alternate the LAN connection periodically. In this embodiment, the interface assembly <b>208</b> sends a command to the CLRM <b>222</b> every predetermined time period, such as one hour, to switch to another communication link <b>228</b>, <b>230</b>. The communication link changeover will only occur when there are no messages to be transmitted to the central processing system <b>204</b> and a message is not currently being received from the central processing system <b>204</b>. If either of these conditions is present, the interface assembly <b>208</b> can wait a predetermined time duration, such as 15 seconds, to again attempt to effect the communication link switch. The interface assembly includes one or more timers <b>260</b> to provide the requisite communication switch and retry time durations. The timers <b>260</b> may be implemented using discrete hardware, such as resistor-capacitor circuits, counters, frequency dividers, etc. Alternatively (or in addition), the timers may be implemented as a function of the processor <b>248</b> operating under the control of software/firmware <b>250</b>. Further, the communication link redundancy module <b>222</b> may wait the predetermined time duration (e.g., fifteen seconds) using one or more timers <b>252</b> to retry the communication link switch.

[0045] As previously indicated, a slave CLRM <b>234</b> may be used at the central processing system/hub side of the LAN connection. In this case, each of the redundant communication links <b>228</b>, <b>230</b> are coupled between the master CLRM <b>222</b> and the slave CLRM <b>234</b>. The slave CLRM <b>234</b> will select the appropriate communication link <b>228</b>, <b>230</b> to provide to the hub <b>238</b> (or directly to the central processing system <b>204</b>) depending on the action of the master CLRM <b>222</b>. Thus, if the master CLRM <b>222</b> switches from the primary port <b>224</b> to the backup port <b>226</b> such that communication link <b>230</b> becomes the active communication link, then the slave CLRM <b>234</b> will also switch to allow the communication link <b>230</b> to be used. This control may be effected directly between the two CLRMs <b>222</b>, <b>234</b>. In one embodiment of the invention, the master and slave CLRMs are implemented using modified versions of the SHORE MICROSYSTEMS' SM-2501 Link Protector.

[0046] Under normal operation, messages received from either the control panel <b>202</b> or the central processing system <b>204</b> pass through the LAN interface <b>200</b> unchanged. These messages may include report requests and responses, control panel state messages, commands, etc. Delta messages from the control panel(s) <b>202</b> that indicate a change of state may be modified before being sent to the central processing system <b>204</b>. For example, a time and/or date stamp may be applied, a delta class, and acknowledge identification (ID) may be added before the message is forwarded. The delta class may represent, for example, the classification of the change, such as alarm, supervisory, trouble, monitor, etc. The acknowledge ID may indicate the control panel number or other assigned identifier for tracking purposes. These and other types of messages sent between the control panel(s) <b>202</b> and the central processing system <b>204</b> are reliably transmitted using the redundant communication link methodology of the present invention.

[0047]FIG. 3 is a block diagram illustrating a portion of a LAN interface <b>300</b> in accordance with a more particular embodiment of the invention. The embodiment of FIG. 3 illustrates an exemplary manner for providing the control signal (indicating a disruption and/or loss of the pulse signal) from the terminal server <b>302</b> to the interface assembly <b>304</b>, and for providing the command(s) from the interface assembly <b>304</b> to the communication link redundancy module (CLRM) <b>306</b>. As was described in connection with FIG. 2, the CLRM includes multiple LAN ports, each associated with a redundant LAN communication link. In the example of FIG. 3, two such ports are provided, including the primary port <b>308</b> and one backup port <b>310</b>, from which redundant communication links <b>312</b>, <b>314</b> are provided. The link switch <b>316</b> determines which of the ports <b>308</b>, <b>310</b> will be selected for the active communication link. As previously described, the link switch <b>316</b> is controlled by one or more commands generated at the interface assembly <b>304</b>. The command(s) are generated in response to the terminal server <b>302</b> recognizing a control signal indicative of the disruption and/or loss of a communication exchange between the terminal server <b>302</b> and the central processing system or hub (not shown). FIG. 3 illustrates an exemplary manner in which the control signal and command may be transmitted to the various functional elements of the system.

[0048] As an example, assume that communication between the LAN interface <b>300</b> and a central processing system/hub is established via primary port <b>308</b> and communication link <b>312</b>. During idle periods on the communication link <b>312</b>, a link signal such as an NLP may be transmitted across the communication link <b>312</b> via the primary port <b>308</b>. Because FIG. 3 assumes a standard LAN connection, the physical medium includes a cable (e.g., coaxial, twisted pair, etc.) having four conductors including a differential transmit pair (Tx− <b>320</b>, Tx+ <b>322</b>) and a differential receive pair (Rx− <b>324</b>, Rx+ <b>326</b>). These signals are transmitted between the CLRM <b>306</b> and the LAN port <b>328</b> of the terminal server <b>302</b>. If any two or more of the transmit or receive signals are shorted together, or if any one or more of the transmit or receive signals are open-circuited, the link signal will be disrupted, and will ultimately be suspended by either or both of the central processing system or the terminal server <b>302</b>. If the link signal is not detected by the link signal detection module <b>330</b>, a control signal is generated and transmitted to the interface assembly <b>304</b> via the RS-232 ports <b>332</b>, <b>334</b> of the terminal server <b>302</b> and interface assembly <b>304</b> respectively. The RS-232 interface between the terminal server <b>302</b> and the interface assembly <b>304</b> includes at least a transmit data (TxD) <b>336</b> connection, a receive data (RxD) <b>338</b> connection, and a common (COM) <b>340</b> connection. The COM <b>340</b> connection provides a common reference for the interface assembly <b>304</b>, terminal server <b>302</b>, and CLRM <b>306</b>.

[0049] The RS-232 interface also includes a data carrier detect (DCD) <b>342</b> connection. In one embodiment of the invention, the control signal generated by the link signal detection module <b>330</b> is provided by way of the DCD <b>342</b> of the RS-232 interface. This control signal is provided to the connection state monitor circuit <b>344</b>, which recognizes a change of state of the control signal indicating a disruption and/or loss of the exchanged communication signal (e.g., link pulse). Upon recognizing the change of state of the control signal, the connection state monitor circuit <b>344</b> provides a command to the link switch <b>316</b> of the CLRM <b>306</b> to switch the LAN connection from communication link <b>312</b> to the backup communication link <b>314</b>. In one embodiment, this is accomplished by sending a series of pulses representing the command via the data terminal ready (DTR) <b>346</b> pin on the RS-232 port <b>334</b>, which is ultimately coupled to the link switch <b>316</b> of the CLRM <b>306</b>. The CLRM <b>306</b> may first receive and process the command, and notify the link switch <b>316</b> that a LAN port switch is to occur. The link switch <b>316</b> then disables the primary port <b>308</b>, and enables communication via the backup port <b>310</b> such that communication is re-established on the backup communication link <b>314</b> rather than the primary communication link <b>312</b>. In one embodiment, successful re-establishment of a connection on the redundant communication link is accompanied by a condition being provided to the central processing system to allow it to make the appropriate notifications that a problem has occurred on the network connection. In the mean time, communication will continue on the backup communication link <b>314</b>.

[0050]FIG. 4 is a flow diagram of one embodiment of a method for controlling a plurality of redundant communication links in networked systems, such as fire safety systems, access control systems, security systems, and the like. A link integrity signal is communicated <b>400</b> between the central processing system (or hub as the case may be) and the terminal server or other similar interface device. The link integrity signal is indicative of a complete loss of a LAN connection, and/or a short-circuit of any two or more of the signal conductors comprising the LAN connection, and/or an open-circuit of any one or more of the signal conductors comprising the LAN connection. Any such condition will affect the integrity of the link signal, and thus provides an indication of the integrity of the currently-active communication link. As previously indicated, the link integrity signal may be a periodic signal sent between the central processing system/hub and the terminal server (e.g., NLP), or other communication exchange such as messages sent back and forth to IP-addressable central processing systems/hubs and terminal servers.

[0051] The link integrity signal is monitored <b>402</b> at the terminal server to determine the communication state of the currently-active communication link. Based on the link integrity signal (and thus ultimately based on the state of the currently-active communication link), a command is generated <b>404</b>. In one embodiment, the command is based on the state of a control signal generated at the terminal server, which in turn is based on the state of the link integrity signal. For example, a control signal may be generated at the terminal server as a simple binary logic signal in one embodiment of the invention. In this embodiment, a first logic level (e.g., low logic level) may represent the presence of a normal link integrity signal, and a second logic level (e.g., high logic level) may represent a disrupted and/or suspended link integrity signal. This control signal may then be monitored by the interface assembly, which in turn generates the command based on the state of the control signal.

[0052] It is then determined <b>406</b> whether the command indicates a communication failure of any one or more signals associated with the currently-active communication link. If not, no switching as a result of a faulty communication link is required, and the communication <b>400</b> of the link integrity signal continues. On the other hand, if the command indicates a communication failure as a result of any of the conductors of the LAN interface being short-circuited or open-circuited, the LAN connection will be switched <b>408</b> from the currently-active communication link to a redundant communication link. It is noted that the subsequent failure of the redundant communication link may ultimately result in an attempt to switch back to the original communication link, or to switch to another redundant communication link in the case of more than two communication links are available.

[0053]FIG. 5 is a flow diagram of another embodiment of a method for controlling a plurality of redundant communication links in a networked system. The link integrity signal is communicated <b>500</b> between the central processing system (or hub as the case may be) and the terminal server or other similar interface device. It is determined <b>502</b> whether the communication link is lost, and/or any conductors are short-circuited or open-circuited. If not, communication <b>500</b> of the link integrity signal continues. In one embodiment of the invention, normal communication is periodically alternated between the various redundant communication links of the system. For example, the LAN connection may be alternated between a primary and backup communication link every hour. If the timer (e.g., one hour timer) has not expired as determined at decision block <b>504</b>, normal link integrity signal communication <b>500</b> continues. If the timer has expired <b>504</b>, the interface assembly generates a command to switch the communication link to another communication link, and the command is transmitted to the communication link redundancy module (CLRM) as shown at block <b>506</b>.

[0054] In one embodiment, alternating communication links will not be allowed when there are messages to be transmitted to the central processing system, or if a message is currently being received from the central processing system, which is determined at decision block <b>508</b>. If no such messages are active, the CLRM switches <b>524</b> from the current communication link to a redundant communication link. On the other hand, if messages are to be transmitted to the central processing system or a message is currently being received from the central processing system as determined at decision block <b>508</b>, a timer is initiated <b>510</b> in order to initiate a retry process. For example, another attempt to switch from the current communication link to the redundant communication link may be delayed for fifteen seconds. When this fifteen second duration (or other established duration) has expired <b>512</b>, it may again be determined <b>508</b> if any such “active” message processes are in progress. This may continue until no messages are to be transmitted to the central processing system or the pending message has been received by the central processing system. At this time, the CLRM switches <b>524</b> from the current communication link to a redundant communication link.

[0055] If it is determined <b>502</b> that communication link is lost, and/or any conductors are short-circuited or open-circuited, communication of the pulse signal may be suspended <b>514</b>. Either the central processing system or the terminal server may first recognize the loss of the communication link and suspend <b>514</b> the pulse signal. In any case, the terminal server ultimately recognizes <b>516</b> the communication link fault. A control signal is generated <b>518</b> at the terminal server, where the state of the control signal is based on the state of the pulse signal. For example, because the pulse signal has been suspended, the control signal will reflect this condition. In one embodiment, the control signal is continuously monitored by the interface assembly, and where the link integrity signal is being properly communicated, the control signal will reflect that condition as well. The control signal is monitored at the interface assembly, and in the case of suspended pulse signal communication, the interface assembly will recognize <b>520</b> the change of state of the control signal. Based on this information, a command is generated and transmitted to the CLRM as shown at block <b>522</b>. This command directs the CLRM to switch <b>524</b> from the current communication link to a redundant communication link, so that communication between the one or more control panels and the central processing system(s) may continue.

[0056]FIG. 6 is a flow diagram illustrating one embodiment for attempting to re-establish communication on a previously failed communication link. The interface assembly recognizes <b>600</b> the change of state of the control signal, thus indicating a short-circuit, open-circuit, or other failure of the currently-active communication link. A command is transmitted <b>602</b> to the CLRM to close the LAN connection. As described in connection with FIG. 2, this can be accomplished by providing an open/close (O/C) signal to the appropriate primary/backup port(s) at the CLRM. The LAN connection is closed for a predetermined period, such as thirty seconds, to ensure that the central processing system also recognizes the loss of communications due to its internal timer expiring. At the interface assembly, when this predetermined time period (e.g., thirty seconds) expires as determined at decision block <b>604</b>, it can be assumed that the central processing system has recognized the loss of communications. The interface assembly then transmits <b>606</b> a command to the CLRM to switch from the current communication link to the backup communication link, and transmits a command to reopen <b>608</b> the LAN connection. Based on these commands, the CLRM switches <b>610</b> from the current communication link to the backup communication link. An alarm relay may optionally be activated <b>612</b> to cause a trouble condition to occur at the control panel(s), thereby notifying the control panels of the situation.

[0057] In one embodiment the interface assembly will request that the CLRM switch back to the original (i.e., failed) communication link and attempt to establish communication after a time duration has expired. Such a time duration may be, for example, a one hour time duration. When the timer for such a time duration has expired as determined at decision block <b>614</b>, the CLRM will switch <b>616</b> from the backup communication link to the original communication link. If communication is established within a predetermined time (e.g., one minute) as determined at decision block <b>618</b>, this original communication link will remain active as shown at block <b>620</b>, and the trouble condition may be cleared after the link has been successfully established for a predetermined time (e.g., five minutes). If communication is not established with the original communication link within the predetermined time, the CLRM will switch <b>622</b> the LAN connection back to the operable backup link.

[0058]FIG. 7 is a flow diagram of a representative initialization process to initially establish an active communication link. A power up, microprocessor reset, or other reset condition occurs as shown at block <b>700</b>. The LAN connection is closed <b>702</b> by the CLRM for a predetermined period, such as one minute, to ensure that the central processing system has detected the loss of interface communications. When this time period has elapsed as determined at decision block <b>704</b>, the LAN connection is opened <b>706</b> and switched <b>708</b> to the primary port.

[0059] If it is determined <b>710</b> that a connection on the primary port is established within a predetermined period of time (e.g., one minute), communication will be effected via the primary port as shown at block <b>712</b>. Whether communication is established may be determined by monitoring the DCD input from the terminal server, as previously described. If it is determined <b>710</b> that the connection on the primary port has not been established within the predetermined time period, the LAN connection is switched <b>714</b> to the backup port (or to one of a plurality of backup ports in the case of more than two total redundant communication links). If it is determined <b>716</b> that a connection on the backup port is established within a predetermined period of time (e.g., one minute), communication will be effected via the backup port, and the alarm may be activated if communication is established on the backup link as shown at block <b>718</b>. Otherwise, the LAN connection switches <b>720</b> back to the primary port, and no further action is taken until the connection on the primary port has been detected as determined at decision block <b>722</b>. When this occurs, communication is effected via the primary port as shown at block <b>724</b>. Alternatively, establishing communication on either the primary or backup ports may be attempted at decision block <b>722</b>, and establishing a communication link will result in communication via the respective link.

[0060] The foregoing description of various embodiments of the invention has been presented for the purposes of illustration and description. It is not intended to be exhaustive or to limit the invention to the precise form disclosed. Many modifications and variations are possible in light of the above teaching. It is intended that the scope of the invention be limited not with this detailed description, but rather by the claims appended hereto.